Privacy policy

1. Who is responsible

The controller for the personal data described in this policy is the legal entity operating Exodus Labs AI, an automation studio operating internationally. Its full registered details are available on request from hello@exoduslabsai.com, and are stated on every proposal and invoice we issue.

For anything to do with your data, including a request to exercise a right, write to hello@exoduslabsai.com.

2. Two different roles, kept separate

This matters, because the answers are different.

• This website. We are the controller. We decide what is collected here and why. Sections 3 to 9 cover it.
• Systems we build for clients. We are a processor acting on the client's instructions. The client decides what is collected and why, and their own privacy policy governs it. Section 10 covers it.

If you are a customer of one of our clients and you want to exercise a right over your data, the fastest route is that business directly. If you write to us, we will pass it to them promptly and help them answer.

3. What this website collects

The contact form

Your name, your company name if you give one, your email address and the message you write. We use it to answer you and to prepare the audit you asked for. Nothing else.

The chat on this page

The messages you type. They are sent to a third party AI provider acting as our processor, purely so a reply can be generated, and they come straight back. If the conversation reaches a point where a person is needed, the recent exchange is forwarded to us so that we can pick it up. Do not put payment details, passwords or health information into the chat. There is no reason to, and we ask you not to.

Server logs

Our hosting provider keeps short lived technical logs, which can include an IP address, for security and to keep the site up. We do not use them to build a profile of you and we do not combine them with anything else.

What this site does not collect

• No cookies of any kind, including no analytics or advertising cookies.
• No tracking pixel, no advertising tag, no session recording, no heatmap.
• No third party fonts, no third party scripts, no embedded widgets from other companies. Every file on this page is served from this domain.
• No account, no password, no profile.
• Nothing stored on your device by this site.

This is why you have not been asked to accept anything. There is nothing to accept.

4. Why we are allowed to hold it

Where a legal basis is required, for example under the GDPR, ours is as follows.

• Answering your enquiry and preparing an audit. Steps taken at your request before entering a contract, and our legitimate interest in responding to people who contact us.
• Delivering an engagement. Performance of the contract with you.
• Keeping the site up and secure. Our legitimate interest in operating a service that is not abused.
• Invoices and accounting records. Compliance with a legal obligation.
• Anything else. Your consent, which you can withdraw at any time.

5. Who else sees it

A small number of suppliers process data on our behalf, under contract, only on our instructions, and only for what is listed here.

• Our website hosting and network provider.
• Our email provider, for messages sent to and from our address.
• The AI provider that generates chat replies.
• A messaging service that alerts us when a website visitor needs a person.

We name every one of them, in full, to any client or visitor who asks. We do not list them on this page because our supply chain is part of how we work, not public information, and naming categories is what a policy is required to do. Ask and you get the list.

We never sell personal data, we never rent it, and we never share it for anyone else's advertising. We do not pass client data to any provider for use as training material for their models.

The only other cases where we would disclose data are a legal obligation we cannot lawfully refuse, or the defence of a legal claim. If we are ever compelled to hand over client data and we are permitted to tell the client, we will.

6. Where it goes

We operate internationally and our suppliers do too, so personal data may be processed in a country other than yours. Where data protected by the GDPR or a comparable regime leaves its home jurisdiction, the transfer is covered by an appropriate safeguard, in practice the European Commission's standard contractual clauses or an adequacy decision. The safeguard applying to a specific engagement is set out in the data processing agreement for that engagement.

7. How long we keep it

• Enquiries that do not become engagements. Up to twenty four months, then deleted.
• Chat conversations. Kept only as long as needed to answer and to follow up, and not used for anything else.
• Client records during an engagement. For the duration of the engagement.
• After an engagement ends. Client data is deleted or returned on request, and in any case within a reasonable period, except what we must keep for accounting and legal purposes.
• Invoices and accounting records. For the period the applicable law requires, typically several years.
• Server logs. Short lived.

8. Your rights

Depending on where you are, you have some or all of the following, and we honour them for everyone rather than checking your postcode first.

• Access. A copy of the personal data we hold about you.
• Rectification. Correction of anything inaccurate.
• Erasure. Deletion, where we have no overriding obligation to keep it.
• Restriction and objection. Including objecting to processing based on legitimate interest.
• Portability. Your data in a common machine readable format.
• Withdrawing consent. At any time, without affecting what was done before.
• Complaint. To the data protection authority in your country, at any time. You do not have to come to us first, though we would rather you did so we can fix it.

Write to hello@exoduslabsai.com. We reply within thirty days, usually much sooner, and we do not charge for a reasonable request.

9. Security

Access to data is limited to the people who need it to do the work. Connections to this site and to the systems we run are encrypted in transit. Credentials are held in restricted storage, never in a document or a chat message. We review access when an engagement ends.

No system is perfectly secure and anyone who tells you otherwise is selling something. If a breach occurs that is likely to affect you, we notify the affected clients and the relevant authority within the time the applicable law requires, and we tell you what actually happened rather than a sanitised version.

10. Data inside the systems we build

When we build and run a system for a client, the personal data flowing through it belongs to that client and we act on their instructions.

• Client data is never shared between clients, and never pooled.
• Client data is not used to train models, ours or anyone else's.
• Voice and messaging agents disclose that they are AI when asked, so the people interacting with them know what they are dealing with.
• Where the GDPR or a comparable regime applies, a data processing agreement is signed before the build starts, listing every sub processor, every purpose and the security measures in place.
• Recording of calls or storage of conversations happens only where the client has instructed it and has the legal basis for it. Where the law requires the caller to be informed, the system informs them.

11. Children

This site and our services are aimed at businesses. We do not knowingly collect personal data from children. If you believe a child's data has reached us, write to us and we will delete it.

12. Changes

If we change this policy we update the version and date at the top of the page. For a change that materially affects how we handle data of an existing client, we tell that client directly rather than relying on you noticing a date change.